Vulnerabilidades

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words,…

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, repopulated continuously by an hourly cron and…

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.

Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.